A quantum algorithm for examining oracles 



Hiroo Azuma 

Canon Inc., 5-1, Morinosato-Wakamiya, 
Atsugi-shi, Kanagawa, 243-0193, Japan 
Ti" . E-mail: azuma.hiroo@canon.co.ip 

o 

^ : October 7, 2004 



O 



o 



X 



Abstract 



O 

I In this paper, we consider a quantum algorithm for solving the following problem: 

^ ■ "Suppose / is a function given as a black box (that is also called an oracle) and 

. / is invariant under some AND-mask. Examine a property of / by querying the 



oracle." We compare the efficiency of our quantum algorithm with that of classical 
QQ ' algorithms by evaluating the expected number of queries for each algorithm. We 

CD ■ show that our quantum algorithm is more efficient than any classical algorithm 

in some cases. However, our quantum algorithm does not exhibit an exponential 
, ^ speedup in the size of an input, compared with the best classical algorithm. Our 

p, • algorithm extracts a global property of / (that is, invariance of /) while it neglects 

local properties of / (that is, outputs of /). We can regard our algorithm as an 
Ch ' application of Simon's algorithm. 



1 Introduction 



Since R.P. Feynman claimed in 1980's that we need a computer that runs on the principle 
\ of quantum mechanics to simulate a quantum system efficiently, many researchers have 
been studying quantum computation J^. After his early work, D. Deutsch formalized 
the current model of the quantum computation j2]. Because it is believed that a quan- 
tum computer solves certain problems faster than any classical computer, the quantum 
computation draws many researchers' attention. Well-known examples of quantum al- 
gorithms are Deutsch and Jozsa's algorithm, Simon's algorithm, Shor's algorithm, and 
Grover's algorithm 01 IH El IH] • (Shor's algorithm shows that a quantum computer can 
factor integers and find discrete logarithms in polynomial time. It is widely believed that 
no classical algorithm solves these problems in polynomial time. Comprehensive reviews 
of the quantum computation are given in Ref. [Zj.) These algorithms make good use 
of the properties of quantum mechanics, namely, the principle of superposition and its 
interference, entanglement, and the principle of uncertainty. 

Simon's algorithm solves the following problem. Suppose / : {0, 1}" — > {0, 1}" is a 
function given as a black box, which is called an oracle by computer scientists. We are 
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promised that one of two cases occurs: (1) all f{x) (for x G {0, 1}") are different, that is, 
/ is one-to-one; (2) there exists an unknown ra-bit string 0) such that Vx, G {0, 1}" 
{f{x) = f{y) if and only if x = y or x = y (B s), that is, / is two-to-one. Determine which 
of the two cases holds, and in the second case, find s. (0 is an n-hit string whose every 
bit has a zero in its entry, = 0...0. © denotes the bitwise XOR.) 

This problem is called Simon's problem. We want to solve it as efficiently as possible. 
(We want to let the number of queries to the oracle become fewer.) To solve the problem 
by a classical method, we need at least of the order of 2" queries on average. (To be 
exact, any classical bounded-error probabilistic computer requires exponential time in 
the expected sense to solve Simon's problem.) By contrast, Simon's quantum algorithm 
solves the problem with poly{n) queries on average, where poly{n) denotes a polynomial 
in n. 

Simon's algorithm finds a period of the function /. It neglects local information of /, 
that is, which value f{x) takes for each x G {0, 1}", and extracts only global information 
of /, that is, the period s. Shor's algorithm has this feature as well. 

Developing a new quantum algorithm is an important topic in the field of the quantum 
computation. In this paper, we consider the following problem that is similar to Simon's. 
Let us assume that the function / : {0, 1}" {0, 1}" is given as an oracle and / has 
invariance f{x As) = f{x). We also assume that we do not know the n-bit string s except 
that the Hamming weight of s is given by wt(s) = m. The problem is to find s. (A 
denotes the bitwise AND. We assume 1 < m < n — 1. As shown later, / is a 2"~'"-to-one 
function.) 

We want to solve this problem as efficiently as possible, too. Evaluating the lower 
bound of the expected number of queries required by a classical computer to solve the 
problem, we show that it is given by 1 -|- [logg for wt(s) = 1 and it is given by 
— (1/n) -|- (3/2) + {n/2) for wt(s) = n — 1, respectively. In the case of 2 < wt(s) < n — 2, 
we cannot derive the classical lower bound. 

By contrast, the expected number of queries for our quantum algorithm approximates 
2 -|- loggm, where m = wt(s). Furthermore we note that the expected number of queries 
for wt(s) = 1 is equal to exactly two. Thus we conclude that our quantum algorithm is 
more efficient than any classical algorithm for wt(s) = 1 and wt(s) = n — 1. 

A network of quantum gates for our algorithm is the same as that for Simon's algo- 
rithm. Hence, we can regard our algorithm as an application of Simon's. However, ours 
has the following new feature. To obtain the binary string s, we apply a certain classical 
procedure to values observed in trials of our algorithm. Thus we have to use a recurrence 
formula to derive the expected number of queries. This point cannot be found in the 
other quantum algorithms. 

A good quantum algorithm (like Simon's) takes polynomial time in n for solving a 
certain problem, where n is the size of an input, while any classical algorithm takes ex- 
ponential time in n. But, our algorithm does not exhibit such an exponential quantum 
speedup in the size of an input, compared with the most efficient classical algorithm. 
However, our quantum algorithm extracts only the global property of the oracle with ne- 
glecting the local properties of the oracle. We think this fact important for understanding 
quantum computation. 

This paper is organized as follows. In Sec. |2l we define a problem that we consider 
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through this paper and describe a quantum algorithm to solve it. We explain how this 
algorithm works. In Sec. El we estimate the expected number of queries to the oracle 
in the quantum algorithm defined in Sec. |21 In Sec. El we discuss the lower bound of 
the number of queries required by any classical algorithm for solving the problem defined 
in Sec. El We evaluate the lower bounds for wt(s) = 1 and wt(s) = n — 1. In Sec. 
we investigate two typical classical algorithms for 2 < wt(s) < n — 2. We estimate the 
expected number of queries for each of them. In Sec. IHl we consider a quantum algorithm 
for examining a function that is invariant under some OR-mask. In Sec. |71 we give a brief 
discussion. 



2 A problem and a quantum algorithm 

In this section, we define a problem that we discuss through this paper, and we give a 
quantum algorithm to solve it. Then, we explain how our algorithm works. 

First of all, we give some notations. We prepare two arbitrary n-bit strings a, 6 G 
{0,1}". (We have a = aia2...a„, where Oj G {0,1} for i = l,...,n. We apply the same 
to b.) We define the bitwise AND of a and 6 as c = a A 6 G {0, 1}", where q = ajfoj 
for i = l,...,n. We define the bitwise OR of a and 6 as c = aV6G {0,1}", where 
Cj = max(aj, bt) for i = 1, n. We define the bitwise XOR of a and 6 as c = a©6 G {0, 1}*^, 
where q = + bi (mod 2) for i = 1, ...,n. Moreover, we write the inner product of a 
and b as a-b = X^iLi ^i^i (mod 2). We describe the number of nonzero bits in a as wt(a), 
and we call it the Hamming weight of a. (Clearly it satisfies < wt(a) < n.) a is a binary 
string obtained by reversing each bit of a as 1. We write an n-bit string whose every 
bit is equal to zero as 0(= 0...0), and an n-bit string whose every bit is equal to one as 
1(= 1...1). (We obtain relations, wt(0) = 0, wt(l) = n, = 1, and 1 = 0, immediately.) 

Let us consider a state on a system that consists of qubits. (The qubit is a two-state 
system {|0), |1)}.) Quantum computation is a sequence of unitary transformations and 
measurements applied to this multi-qubit system. We define the following two unitary 
transformations. The first one is the Hadamard transformation H, which works on a 
qubit as follows: 

/ |0) - (l/v^)(|0) + |l)) 
•\ |1) - (1/V2)(|0)-|1)) ■ ^ > 

H^"' transforms an n-qubit state \x) = |xi)...|a;„) Wx G {0, 1}" as follows: 

H^-\x) = ^ E (-in?/)- (2) 

The second one is Uf that realizes an oracle of a function / : {0, 1}" {0, 1}" as follows: 
Uf\x)\y) = \x)\y+f{x) (mod 2")) Vx, y G {0, 1}". (3) 
We define the problem as follows: 
[Problem] 
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Suppose that we are given a function / : {0, l}*^ — > {0, 1}". We are promised that there 
exists an ra-bit string s such that Va;, y G {0, 1}" {f{x) = f{y) if and only ii x As = y As). 
We do not know s except that we are given wt(s) = m. Find s. 

In this problem, we find immediately that s = if wt(s) =0 and s = 1 if wt(s) = n. 
Thus, we assume s 7^ 0, 1. As shown later, / is a 2"'~™'-to-one function. 
We consider the following quantum algorithm. 

[Algorithm] 

1. We prepare two registers that consist of n qubits respectively, and put each qubit 
in |0) as an initial state. We obtain a state |0)"|0)"'. 

2. We apply the Hadamard transformation H to each qubit of the first register. From 
Eq. ((21), we obtain 

^ E k)lo)- (4) 



nr. 

(Here, we rewrite lO)" on the second register as |0) for simplicity.) 

3. Applying the given oracle [// to the registers, we store /(x) in the second register 
according to the value x in the first register. Thus, we obtain 

E (5) 
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^ a;G{0,l} 

4. We apply H to each qubit of the first register again. We obtain 

1 



E (if^1x))|/(a:)). (6) 



/On 
^ ^ xG{0,l}" 

5. We observe the first register in a logical ket basis : x G {0, 1}"}. Let us suppose 
that we obtain \k). If wt(/i;) = m, we let s = k. If wt(/c) < m, we carry out operation 
from the first step to the fourth step again and observe the first register. (We call 
this process a trial.) Rewriting k obtained by the first trial as koid and writing a 
string obtained by the second trial as knew, we calculate 

k = koid V knew (7) 

If wt(/c) = m, we let s = k. If wt(A;) < m, we rewrite k as koid, obtain knew by 
another trial, and calculate k = kdd V knew We repeat this procedure until we have 
wt{k) = m. When wt(A;) = m, we obtain s = k. 

We explain the reason why we can obtain s by the above algorithm. First, we pay 
attention to the following fact. Vx, y G {0, !}"■, f{x) = f{y) if and only if x A s = y A s, 
and wt(s) = m is given. Thus, / is a 2"~™-to-one function. This is because the number 
of bits that hold zeros in the string s is equal to (n — m) and the function / does not 
depend on these (n — m) bits. Hence, we can classify 2" inputs of / (that is, x G {0, 1}") 
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into 2™ classes according to values that they take as outputs of / (that is, f{x)). The 
number of inputs in each class is equal to 2""™. 

From this consideration, we can rewrite Eq. (jSj) that is obtained after the third step 
of the algorithm as follows: 

^ E ( E 0)1/(0). (8) 



nr. 

^ l:l=xAs,x€{0,l}" a:a=yAs,j/G{0,l}" 

In Eq. (jS)), the binary string / has zeros in entries where s has zeros, and / has either zeros 
or ones at random in entries where s has ones. Thus, there are 2*" possible strings for 
Meanwhile the binary string a has zeros in entries where s has zeros, and a has either 
zeros or ones at random in entries where s has ones. (Put another way, a has zeros in 
entries where s has ones, and a has either zeros or ones at random in entries where s has 
zeros.) Thus, there are 2""*" possible strings for a. 

Next, we apply H to each qubit of the first register in Eq. (jHl) for the fourth step. Here, 
we consider only the n qubits of the first register, (1/a/2"~™) J2a We permute these 

n qubits, so that zeros of the string s move to the left side and ones of s move to the right 
side. Because H works upon each qubit independently, this permutation does not change 
the essence of this discussion. By this permutation, we rewrite (l/-\/2"-~™) J2a k ® 

^ E I"')!''). (9) 

where we can obtain I' by permuting the n-bit string / and removing (n — m) zeros from 
the left side of its entries. Thus, \a') is an (n — m)-qubit state and is an m-qubit state. 

We apply if®" to the state of Eq. ©. From Eq. we find that it transforms the 
state of the first {n - m) qubits (1/^2"-"^) Ea' W) to |0)"-'". Hence, the state of Eq. © 
is transformed to 

J2 (-l)''-'''|0)"-"^|fc'). (10) 

Permuting the qubits in Eq. (fTIHl to the original order, we obtain the following state on 
both the registers: 

^ E [ E (-in^)]l/(0)- (11) 

l:l=xAs,xe{0,l}" k:k=yAs,ye{0,l}" 

Then, for the fifth step, we observe the first register in the basis {\x) : x G {0, 1}"}. 
We obtain a binary string k, where k = y A s and y G {0, l}". There are 2™ possible 
strings for k, and k takes one of them at random, k has zeros in entries where s has zeros, 
and k has either zeros or ones at random in entries where s has ones. Thus, if we repeat 
the trial with observing a string k and perform the bitwise OR to observed strings k as 
Eq. ((Zj) again and again, we will obtain s eventually. In Eq. (jllll . we find that bits in the 
first register depend on only k and phases include information of /. 

Here, let us see a concrete example of our algorithm. We suppose n = 3, s = 110, and 
wt(s) = 2. Then, / is two-to-one. Thus, we may define / : {0, 1}'^ — ^ {0, 1}^. We can 
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classify inputs x G {0, 1}'^ to the following four classes: 



/(OOO) = /(OOl), /(OlO) = /(Oil), 

/(lOO) = /(lOl), /(110) = /(111). (12) 
Preparing an initial state |000)|00) and applying H®^ to the first register, we obtain 

4 E k)|0)- (13) 



CG{0,1}3 

Applying the oracle Uf to Eq. (fT^ , we obtain 

(i/v^)Ek)l/(^)) 



= (l/v^)[(|000) + |001))|/(000)) + (1010) + |011))|/(010)) 

+ (|100) + |101))|/(100)) + (1110) + |111))|/(110))]. (14) 

Applying H®^ to the first register again, we obtain 

(1/4)[(|000) + |010) + |100) + |110))|/(000)) 
+ (|000)-|010) + |100)-|110))|/(010)) 
+ (|000) + |010)-|100)-|110))|/(100)) 

+ (|000) - |010) - |100) + |110))|/(110))]. (15) 

If we observe the first register, we obtain |000), |010), |100), or |110) at random. Let 
us assume that we obtain a string k'^^^ = 010 in the first trial. We know wt(s) = 2 
beforehand. Because wt{k^^^) = 1, we find s ^ k^^\ Then, let us suppose that we obtain 
a string /c^^-* = 100 in the second trial. Calculating k = k^^^ V /c*-^-* = 110 and noticing 
wt(A;) = 2, we find s = A; = 110. 

3 The expected number of queries for the quantum 
algorithm 

In this section, we evaluate the expected number of queries required by the quantum 
algorithm shown in Sec. |21 Moreover, we discuss some features of our algorithm. 

For a start, we investigate running time for our algorithm. As shown later, the expected 
number of queries depends on the Hamming weight of the string s (that is, wt(s) = m), 
while it does not depend on the number of qubits n. Thus, we describe it as Tq^im). The 
subscript Q of TQ(m) stands for "quantum". 

Let us evaluate Tq(1). (We are given wt(s) = m = 1.) We can assume s = 10. ..0 
without losing generality. From Eq. pi|) . after the fourth step of our algorithm, we obtain 

^[(|0...0) + |10...0))|/(0...0)) + (I0...0) - |10...0))|/(10...0))]. (16) 
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We observe the first register. We carry out the trial again if we obtain |0...0), and we 
finish the task if we obtain \s) = |10...0). Thus, we can write Tq{1) as 



11 1 oo 1 

Tq(1) = 1 ■ 2 + 2 • (3)' + 3 • (3)' + - = E H^)'- (17) 



h=l 



Using the formula 



d ^ ^ d X 



^hx^ = x-^^x'^ = X — - 

h=i h=i dxl — X 



X 



for \x\ < 1, 



we obtain Tq(1) = 2. Here, we notice that Tq{1) does not depend on n. 

We can also derive Tq(1) by another way as follows. If we observe the state given by 
Eq. (|TT)|l . we obtain either |0...0) or \s) = |10...0) with probability 1/2 respectively. If we 
observe |0...0), we obtain no information about s and we have to repeat the trial again. 
Thus, in this case, the expected number of queries to obtain s is equal to [1 + Tq(1)]. 
Meanwhile if we observe \s), we obtain s by a single query. This consideration yields a 
relation 

TQil) = l[l+T^il)] + l-l, (19) 

and we obtain Tq(1) = 2. 

Let us evaluate Tq(2). (We are given wt(s) = m = 2.) We can assume s = 110. ..0 
without losing generality. If we observe the first register in the fifth step, we obtain 
000. ..0, 010. ..0, 100. ..0, or 110. ..0 as the binary string k with probability 1/4 respectively, 
as shown in Eq. (jllj) . We pay attention only to the first two bits of k, ki and k2, because 
the other bits (that is, k3,...,kn) always hold zeros as entries. Each of ki and k2 takes 
either zero or one with probability 1/2 independently. If fcj = for i = 1,2, we cannot 
determine an entry of Si and carry out another trial. If fcj = 1 for i = 1,2, we obtain 
Si = 1. 

We have shown two methods for deriving Tq(1) before. Here, we use the latter to 
evaluate Tq(2). In the first trial, we obtain (0,0), (0,1), (1,0), or (1,1) for {ki,k2) with 
probability 1/4 respectively. If we observe (0,0), we obtain no information about s and 
have to have another trial. Thus, the expected number of queries for determining s is 
equal to [1 + Tq(2)]. If we observe (0, 1) or (1, 0), we can determine one of two bits that 
have ones as entries in the string s. Thus, the expected number of queries for obtaining 
s is equal to [1 + Tq(1)]. If we observe (1, 1), we obtain s by a single query. From this 
consideration, we can describe Tq(2) as 

Tq(2) = i[l + Tq(2)] + i[l + rQ(l)] ■ 2 + i ■ 1. (20) 

Using Tq(1) = 2, we obtain Tq(2) = 8/3. 

For general m(> 1), we have the following recurrence formula, 

I / Tflx 

TQ{m) = — [(l+TQ(m))+ J(l + TQ(m-l)) 
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where Tq(0) = 0. Using this formula, we can derive Tq(1) = 2, Tq(2) = 8/3, Tq(3) = 
22/7, and so on, in order from m = 1. From this discussion, we notice that TQ(m) does 
not depend on n. 

It is difficuh to derive a closed-form solution of TQ(m) from Eq. (j^D). Thus, we 
estimate TQ(m) roughly as follows. Let us suppose that wt(s) = m is very large. We 
can assume s = 1...10...0 for simplicity without losing generality. (Hence, we assume 
Sj = 1 for 2 = l,...,m and Sj = for i = m + l,...,n. Furthermore we assume 1 <C 
m < n.) In the fifth step of our algorithm, we observe one of binary strings {k : ki & 
{0, 1} for i = 1, m, and fcj = for i = m + 1, ...,n} at random. Each of the first m 
bits takes either zero or one as an entry with probability 1/2 independently. If we observe 
ki = 1 for i = 1, m, we obtain Si = 1. If we observe ki = for ^ = 1, m, we cannot 
determine Si and have to have another trial. 

Here, let us suppose m = 2*. In the observation of the first trial, half of the first 2* 
bits (that is, about 2*~^ bits) hold ones as entries, and we put them on entries of s. In the 
observation of the second trial, half of the rest undecided (that is, about 2*^^ bits) hold 
ones as entries, and we put them on entries of s. If we repeat this process t times, about 
one bit of s is left undecided. The expected number of queries for deciding a single bit is 
given by Tq(1) = 2. Hence, we obtain Tq(2*) ~ 2 + 1. This result suggests the following 
approximate equation: 

TQ(m) ~ 2 + log2m. (22) 

Figure H represents TQ(m) obtained by Eq. (j^TJ) and its approximate value obtained 
by Eq. (|22j) for 1 < m < 500. It shows that Eq. (|22j) is a good approximation. We can 
conclude that the expected number of queries Tq^rn) is of order logm. 

Our quantum algorithm has two features. The first feature is as follows. Our quantum 
algorithm gives us information about the binary string s which determines the invariance 
of the function /, although it does not tell us which value f{x) takes for each input x. 

In Sec. 121 we show a concrete example of / that takes n = 3, s = 110, and wt(s) = 
m = 2. Every input x G {0, 1}^ is classified into one of four classes according to its output 
/(x), as shown in Eq. (fT^ . This classification is decided by s. We can call it the global 
property of /. By contrast, what value each f{x) takes (that is, which element of {0, 1}^ 
/(OOO), /(OlO), /(lOO), and /(llO) take in Eq. ^ respectively) can be called the local 
property of /. The function / consists of the global property and the local properties. 

Our quantum algorithm extracts only the global information of /. We can find this 
feature in other quantum algorithms as well. 

The second feature is as follows. If we draw a network of quantum gates for our 
algorithm, it is the same as that for Simon's algorithm (see Fig. 12)). Both algorithms 
differ only in promises of their oracles. Our algorithm examines a function that has the 
invariance f{x A s) = f{x), while Simon's algorithm examines a function that has the 
invariance f{x © s) = f{x). 
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Figure 1: The expected number of queries required by the quantum algorithm defined 
in Sec. |21and its approximation. A horizontal axis represents m = wt(s), the Hamming 
weight of s, and a vertical axis represents T, the expected number of queries. Both of m 
and T are dimensionless. We set 1 < m < 500. A solid curve shows Tqlm) obtained by 
Eq. (PT|) . and a dashed curve shows an approximate value of TQ(m) obtained by Eq. (j^ . 
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Figure 2: A network of quantum gates for the quantum algorithm defined in Sec. |2l 
Simon's algorithm also works on this network. 



In Fig. 121 our quantum algorithm seems to require (2n + 1) quantum gates. However, 
we can eliminate 2n Hadamard transformations H by changing the initial state and the 
orthogonal basis for measurement. Thus, a quantum gate that our algorithm essentially 
needs is only the oracle Uf. 

4 The classical lower bounds of the number of queries 

for wt(s) = 1 and wt(5) = n — 1 

To show that the quantum algorithm introduced in Sec. |21 is more efficient than any 
classical algorithm, we need to know the lower bound of the number of queries required 
by an arbitrary classical algorithm. However, in general, it is difficult to evaluate the 
classical lower bound. In this section, we evaluate the classical lower bounds for wt(s) = 1 
and wt(s) = n — 1 exactly. 

4.1 The case of wt(s) = 1 

We discuss the case of wt(s) = m = 1. Let us think about the following classical algorithm. 
For simplicity, we assume n = 2*. We define t strings of length n as follows: 

a^^) = 0101. ..01, 

a(2) = 00110011. ..0011, 

a^*) = 0...01...1. (23) 

a'-'-' is a string of 2'~^ zeros alternating with a string of 2'~^ ones for / = 1, 

We can decide the binary string s = (sj) in the following way. First, we compute /(O) 
and /(a^*-*). If /(O) = /(a^*-*), there exists an only nonzero entry in the left half of the 
n-bit string s, that is, Si = 6ij where 1 < j < n/2. Meanwhile, if /(O) 7^ /(a*^*-*), there 
exists the only nonzero entry in the right half of the n-bit string s, that is, Si = 6ij where 
(n/2) + 1 < j < n. 

Here, for simplicity, we assume /(O) = /(flW). Next, we compute /(a^*"^)). If /(O) = 
/(a*-*"^-*), there exists the only nonzero entry in the first quarter of the n-bit string s from 
the left side, that is, Sj = Sij where 1 < j < n/4. Meanwhile, if /(O) 7^ /(a^*""^-'), there 
exists the only nonzero entry in the second quarter of the n-bit string s from the left side, 
that is. Si = 6ij where (n/4) + 1 < j < n/2. 

By repeating the above process, we locate the only nonzero entry in the string s. If we 
use the binary search explained above, we can obtain s hy {t + 1) queries. For example, 
when s = 10. ..0, we obtain s by answers of queries, /(O) = /(a^*^) = ... = f{a^^^). When 
s = 010. ..0, we obtain s by answers of queries, /(O) = /(a^*^) = ... = f{a^'^^) 7^ /(a^^^). 

For general n, the number of queries to obtain s is given by 

l+[log2nl, (24) 
where [x] denotes a unique integer j such that j — 1 < x < j for any real number x. 
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We show that this binary search is the most efficient algorithm of all classical algo- 
rithms. We consider the information-theoretic lower bound of the number of classical 
queries. (A discussion given here is concerned with an application of the coin-weighing 
problem jH[ El- The coin- weighing problem is as follows: "Suppose that we are given n 
coins, one of which may be a forgery. The forged coin is either too light or too heavy. 
We are also given a balance on which we can place any of the coins we wish. We want to 
determine whether the forgery exists or not, and if it exists, we want to figure out which 
coin is false. Ascertain the minimum number of uses of the balance to accomplish this 
task.") 

Let us count the number of possible functions for /. We note that / is a 2"~^-to-one 
function because of the invariance f{x A s) = /(x), where wt(s) = m = 1. (We explained 
this fact in Sec. El) Hence, we can rewrite / as / : {0, l}*^ — > {0, 1}. Then, / is a 
surjection. There are n possible binary strings for the ra-bit string s because of wt(s) = 1. 
Moreover, we can divide the domain of / (that is, {0, 1}") into two subsets as follows: 

Xo = {a: a = yAs,y e {0,1}"}, 

Xi = {a®s:a = yAs,ye{0,iy'}. (25) 

We have |Xo| = |Xi| = 2""-^, where |X| denotes the number of elements in a set X. 
Clearly, = 0...0 G Xq and s G Xi. We have the following relation: 

m = I i^^l T ^ ^° • (26) 

•' ^ \ f{s) for X G Xi ^ ^ 

When we think about the range of / (that is, {0, 1}), we have two cases: (1) /(O) = 
and /(s) = 1; (2) /(O) = 1 and /(s) = 0. From the above discussion, we can conclude 
that there are 2n possible functions for /. 

Let us suppose that these 2n functions are realized with equal probability, 

P„ = ^for« = l,...,2n, (27) 
2n 

where a is an index of the functions. Then, writing the amount of information that the 
problem holds as S, which can be called entropy, it is given by 

S = -J2Pa log2 Pa = log2(2r2) = 1 + log2 n. (28) 

a 

By contrast, writing the amount of information retrieved by a single query as A, it is 
given by 

A = -2-i-log2^ = l. (29) 

This is because the query has two possible answers, zero and one, as values of f{x) (for 
X G {0, 1}"), and both the answers appear with probability 1/2 respectively. Hence, the 
lower bound of the number of classical queries for solving the problem is given by 

\{S/A)] = 1 + \\og, n] . (30) 
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The number of queries given in Eq. (jHUj) is equal to the number of queries for the binary 
search given in Eq. ()24|) . Thus, we can conclude that the binary search explained before is 
the most efficient algorithm of all classical algorithms. Contrastingly, the expected number 
of queries required by the quantum algorithm defined in Sec. |21 is given by Tq(1) = 2. 
Hence, we can conclude that our quantum algorithm is more efficient than any classical 
algorithm. 

Here, we note the following fact. Equation (j^Hj) shows that the amount of information 
that the problem holds is equal to (1 + log2n). Meanwhile, there are n possible binary 
strings for s that represents the global information of /. There also exist two cases, 
(/(0),/(s)) = (0,1) and (1,0), which represent the local information of /. Hence, the 
global information of the function / amounts to log2 n and the local information of / 
amounts to logj 2 = 1. 

If we want to know only s, we can expect that the minimum number of queries will be 
given by [log2 n\ . However, the binary search cannot distinguish the global information 
and the local information. (The binary search cannot extract only the global information 
of the oracle.) Therefore, the lower bound of the number of classical queries is equal to 
(1+ [logan]). 

4.2 The case of wt(s) = n — 1 

We consider the case of wt(s) = m = n — 1. Then, the promise f{xAs) = f{x) is rewritten 
as 

f{x) = f{x © s) where wt(s) = 1. (31) 

/ is two-to-one. These facts can be seen in the example that holds n = 3, s = 110, and 
wt(s) = 2 in Eq. (fT^. 

In the case of Eq. (jHU), the best classical algorithm is as follows. There are n possible 
binary strings for s. (The Hamming weight of each possible string is equal to one.) We 
examine whether or not these n binary strings satisfy Eq. (jHT|) one by one in order. This 
is a sequential search. 

We define the following n strings of length n: 

= 10.. .0, 
6^2) = 010.. .0, 

= 0...01, (32) 

where 6^*^ = (6^*^) = {6ij) for i,j = 1, ...,n. 6^*^ is a string whose Hamming weight is equal 
to one. 

First, we compute /(O). Next, we compute f{b^^^). If f{b^^^) = /(O), we obtain 
s = b(i) = 01. ..1. If /(6(i)) ^ /(O), we compute /(fo^^^). In this way, we compute f{b^^^) 
for 2 = 1, 2, 3, ... in order, and we obtain s = 6^*) when f{b^^^) = /(O). 

We evaluate the expected number of queries to obtain s. We assume that n possible 
strings for s appear with equal probability. (The Hamming weight of each possible n- 
bit string is given by {n — 1).) If s = 01. ..1, the number of queries is equal to two. If 
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s = 101. ..1, the number of queries is equal to three. In contrast, if s = 1...10, the number 
of queries is equal to n because s is decided by /(fe^""^)) ^ /(O). Thus, the expected 
number of queries is given by 



1 



(2 + 3 + ...+n + n) 



1 3 n 



(33) 



n 




Contrastingly, from Eq. ((221), the expected number of queries required by the quantum 
algorithm defined in Sec. El is given by 



Hence, our quantum algorithm is more efficient than any classical algorithm in the case 
of wt(s) = n — 1. 



5 The number of queries of classical algorithms for 

2 < wt(s) <n-2 



In Sec. 01 we evaluate the lower bounds of the number of classical queries for wt(s) = 1 
and wt(s) = n — 1, and we show that the quantum algorithm introduced in Sec. El is more 
efficient than any classical algorithm in those cases. However, it is difficult to evaluate 
the classical lower bound for 2 < wt(s) < n — 2. Thus, in this section, we introduce 
two typical classical algorithms and evaluate the number of queries for each of them. We 
compare the efficiency of our quantum algorithm with that of the two classical algorithms. 

5.1 An application of the binary search 

Let us consider the first typical classical algorithm as follows. In Sec. 14.11 we show that the 
binary search is the most efficient algorithm of all the classical algorithms for wt(s) = 1. 
We adapt this method to the case of 2 < wt(s) < n — 2. We locate nonzero entries in the 
string s by repeating the binary search m times, where m = wt(s). 

We use the following fact. We suppose that we do not know s except that s is an n-bit 
string and wt(s) = m. We define an ra-bit string u = (uj) as 



Comparing /(O) and f{u), we obtain one of two cases: (1) if /(O) = f{u), sj+i = s;+2 = 
... = Sn = 0; (2) if /(O) 7^ f{u), at least one of s^+i, s;+2, s„ holds a nonzero entry 
(sj = 1 for some i E {I + 1,1 + 2, n}). 

In the concrete, we decide s as follows. We assume n = 2* for simplicity. First, we 



TQ(r2-l) ~2 + log2(n-l). 



(34) 




for 1 < i < /(< n) 

1 for I + 1 < i < n 



(35) 




(36) 
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If /(O) = f{u^^^), we obtain S(„/2)+i = ■S(n/2)+2 = ... = Sn = 0. This implies all of ones in 
entries exist in the left half of the string s. By contrast, if /(O) 7^ f{u^^^), at least one of 
■5(n/2)+i5 S(n/2)+2, holds a nonzero entry. This implies at least one bit holds a nonzero 
entry in the right half of the string s. 

Here, let us suppose /(O) = f{u^^^). We define m*^^^ = {uf'^), where 

(2)^/0 fori = l,2,...,n/4and2= (n/2) + l, (n/2) + 2,...,n 
|1 fori = (n/4) + l,(n/4) + 2,...,n/2 ' 

We compare /(O) and /(m^^-*). From this act, we find which quarter of the string s has at 
least a nonzero entry of a bit, the first quarter or the second quarter from the left side. 
Next, let us suppose /(O) 7^ f{u^^^). We define m*^^^ = (Mj-^''), where 

(2)^/ forz = l,2,...,3(n/4) 

\l forz = 3(n/4) + l,3(n/4) + 2,...,n ■ ^ ' 

We compare /(O) and f{u^'^^). From this act, we find which quarter of the string s has at 
least a nonzero entry of a bit, the third quarter or the forth quarter from the left side. 

By the repetition of this process, we can locate a nonzero entry of a bit in the string s 
by 1 + t = 1 + log2 n queries. (This is the binary search.) The string s includes m nonzero 
entries because of wt(s) = m. We suppose that we locate one of these nonzero entries by 
the above method. Then, the problem is simplified. A new problem is to locate (m — 1) 
nonzero entries in an {n — l)-bit string. 

For example, let us suppose that the right end of the string s is given by s„ = 1 and 
we have located it first. We can locate another nonzero entry of s as follows. We define 
m''-^-* = fw'^^h where 



/(I) _ J for i = 1, 2, n/2 and i = n 

for i= (n/2) + l, (n/2) + 2,...,n 



(39) 



as a substitute of u*^^^ in Eq. (j36j) . Thus, m'*^^-* has a form 0...01...10. Because s„ = 1 
is detected, we put a zero in the nth bit of u''^^\ put zeros in the first half of (n — 1) 
undecided bits, and put ones in the second half of them. 

If /(O) = f{u'^^^), we obtain S(„/2)+i = S(^n/2)+2 = ... = Sn-i = 0. This implies that 
there are (m — 1) ones in the left half of entries of s. ((m — 1) bits of Si, S2, Sn/2 have 
ones as entries.) By contrast, if /(O) 7^ f{u'^^^), at least one of S(„/2)+i, S(n/2)+2, Sn-i 
has a nonzero entry. 

As shown above, if we apply the binary search to unknown [n — 1) bits of s, we can 
find the second nonzero entry of s by [log2(n — 1)] queries. Hence, if we write the number 
of queries to obtain s by this classical algorithm as T^B(m), it is given by 

m 

T^^{m) = 1 + Y^llog^in ~ h + 1)] for m = 1, n - 1. (40) 

h=l 

The subscripts C and B of TQ-g{m) stand for "classical" and "binary", respectively. More- 
over, we note that Eq. (jiUj) gives us Tq^{1) = 1+ [log2 n] and it corresponds with Eq. (j21|). 
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5.2 An application of the sequential search 

Let us consider the second typical classical algorithm as follows. In Sec. 14. 2[ we show 
that the sequential search is the most efficient algorithm of all the classical algorithms for 
wt(s) = n — 1. We adapt this method to the case of 2 < wt(s) < n — 2. We use the n 
strings of length n, b^^^ (for i = 1, ...,n), defined in Eq. ()32|) again. 

First, we compute /(O). Next, we compute f{b^^^). If f{b^^^) = /(O), we obtain si = 0, 
where Si is the ffist bit of the string s. By contrast, if f{b^^^) ^ /(O), we obtain si = 1. 
Likewise, computing f{b^'^^) and applying the following rule 





1 



(41) 



to it for z = 1, 2, n in order, we decide entries of the string s one by one from the ffist 
bit. We are given wt(s) = m beforehand. Thus, when m nonzero bits appear in the string 
s in the middle of the above process, we can decide the whole s immediately and finish 
the task. 

Let us write the expected number of queries required by this algorithm for wt(s) = m 
as T^g(m). The subscripts C and S of T^s("^) stand for "classical" and "sequential", 
respectively. We can find the following properties of TQg(m) instantly. Clearly, T^si'm) < 
n. (Because we are given wt(s) = m, we can always decide the whole s certainly by 
computing /(O), /(fe*^^-*), and f(b^"'~^^).) Moreover, we have TQ^{m) = T^g(^i — ra). 
This is because specifying the string s that has wt(s) = m corresponds to not only locating 
m nonzero bits but also locating (n — m) entries that have zeros. Furthermore, we have 
obtained 

TUn-l)=TU^) = -- + l + l (42) 

in Eq. ()33|) already. 

As a concrete example, we calculate T^g(2). When wt(s) = 2, there are possible 
strings for s. The string s = 110. ..0 requires the fewest queries among them. It requires 
three queries. Strings that require four queries are s = 1010. ..0 and s = 0110. ..0. Likewise, 
if 3 < / < n — 2, there exist (/ — 2) possible strings that are specified just with / queries. 

However, we cannot apply the similar discussion to strings that is specified with (^ — 1) 
queries. First, {n — 3) strings, 10. ..0100, 010. ..0100, 0.. .01100, whose last three bits are 
given by 100, are specified by {n — 1) queries. Moreover, a string 0...011 can be specified 
by {n — 1) queries as well. (The string 0...011 is specified when the ffist (n — 2) zeros are 
located as entries.) Hence, there exist [(n — 3) + 1] strings that can be specified just by 
(n — 1) queries. 

Strings specified by n queries are as follows. First, {n — 2) strings, 10. ..010, 010. ..010, 
0...0110, whose last two bits are given by 10, are specified by n queries. Furthermore, 
(n — 2) strings, 10. ..01, 010. ..01, 0...0101, whose last two bits are given by 01, are 
specified by n queries as well. Thus, the number of strings that are specified just by n 
queries is [{n — 2) + {n — 2)]. 



Hence, we obtain 



1 " 

7^cs(2) = 7;^[E Hh - 2) + (n - 1) + n{n - 2)]. (43) 

h=3 
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Figure 3: The expected number of queries for solving the problem defined in Sec. |2]with 
n = 200 and 1 < m < 199. A horizontal axis represents m = wt(s), the Hamming weight 
of s, and a vertical axis represents T, the expected number of queries. Both m and T are 
dimensionless. T on the vertical axis is represented on a logarithmic scale. A thick solid 
curve represents TQ(m) defined in Eq. (PT|) (the quantum algorithm introduced in Sec.|2I), 
a thin solid curve represents T^B(m) defined in Eq. (j40p (the application of the binary 
search), and a thin dashed curve represents TQg(m) defined in Eq. (j44p (the application 
of the sequential search). 



From similar discussion, for l<m<n — 1, we obtain 



h-2\ .Jn 



-cs 



(m) 



E,"L_j + i:("-Mi (44) 



m 

I n\ _ 

h=m+l V" h=0 




The definition of TQg{m) in Eq. (jl^ includes the expression of TQg{n — l) given in Eq. 
and that of 7cg(2) given in Eq. Moreover, Eq. satisfies the relation Tq^^ui) = 

TSs{n-m). 

Figure El shows Tq^tji) defined in Eq. (j?T|) . Tq-q^iti) defined in Eq. pn|) . and Tcs(m) 
defined in Eq. (I44p for n = 200 and 1 < m < 199. A horizontal axis represents m, the 
Hamming weight of s, and a vertical axis represents T, the expected number of queries. 
T on the vertical axis is represented on a logarithmic scale. Figure El shows that the 
quantum algorithm defined in Sec. |21 is more efficient than two classical algorithms (that 
is, the applications of the binary search and the sequential search) discussed in this section. 



6 A quantum algorithm for examining an OR-mask 
invariant oracle 

In the previous sections, we consider the problem that is to find the binary string s 
by querying an oracle / that has the invariance f{x A s) = f{x). In this section, we 
consider a similar problem that is to find s by querying an oracle g that has invariance 
g{x V s) = g{x). 
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The problem is given explicitly as follows: "Suppose that we are given a function 
g : {0, l}'^ — *■ {0, !}"■. We are promised that there exists an n-bit string s such that 
Vx, y G {0, 1}" {g{x) = g{y) if and only ii x\/ s = y\J s). We do not know s except that 
we are given wt(s) = n ~ m. Find s." 

If wt(s) = or n, s is trivial. Thus we assume s 7^ 0, 1. g is a 2"~™-to-one function. 

We can solve the above problem by a quantum algorithm that is similar to the algo- 
rithm introduced in Sec. |21 Let us carry out the steps 1, 2, 3, and 4 in the algorithm 
discussed in Sec. |21 First, we note the following fact. Vx, ?/ G {0, 1}", g{x) = g{y) if and 
only if X V s = ?/ V s, and wt(s) = n — m is given. Thus, g is a 2"~™-to-one function. This 
is because the number of bits that hold ones in the string s is equal to {n — m) and the 
function g does not depend on these {n — m) bits. Hence, we can classify 2" inputs of g 
(that is, X G {0, l}*^) into 2"^ classes according to values that they take as outputs of g 
(that is, g{x)). The number of inputs in each class is equal to 2^~"^. 

From this consideration, we can rewrite Eq. © that is obtained after the third step 
of the algorithm as follows: 

4^ E ( E \a®l)Ml)). (45) 

V ^ l:l=xAs,x&{0,l}" a;a=j/As,j/G{0,l}" 

In Eq. ()45|) . the binary string / has zeros in entries where s has zeros, and / has either 
zeros or ones at random in entries where s has ones. Thus, there are 2"^ possible strings 
for /. Meanwhile, the binary string a has zeros in entries where s has zeros, and a has 
either zeros or ones at random in entries where s has ones. Thus, there are 2"""^ possible 
strings for a. 

Next, we apply H to each qubit of the first register in Eq. (^3)) for the fourth step. 
Here, we consider only the n qubits of the first register, (1/^2"""^) J2a |a©0- We permute 
these n qubits, so that ones of the string s move to the left side and zeros of s move to 
the right side. By this permutation, the state of the first register is rewritten as Eq. Q. 
jj-^n-m transforms the superposition of states \a') to lO)""*". Thus, Eq. (I45j) is transformed 
to the following state: 

^ E [ E {-iy-'\k)Mi)). (46) 

l:l=xAs,x&{0,l}" k:k=yAs,y£{0,l}" 

Then, we observe the first register in the basis : x G {0, 1}"}. By this observation, 
we obtain a binary string k, where k = yAs and y G {0, 1}". There are 2"^ possible strings 
for k, and k takes one of them at random, k has either zeros or ones at random in entries 
where s has zeros, and k has ones in entries where s has ones. Thus, if we repeat the trial 
with observing a string k and perform the bitwise AND to observed strings k again and 
again, we will obtain s eventually. (Suppose we obtain k. If wt{k) = — m, we let s = k. 
If wt(A;) > n — m, we rewrite k as k^id, carry out the trial again, obtain a new observed 
results knew, and have k = koid A knew We repeat this procedure.) 

Clearly, the expected number of queries to obtain s by this quantum algorithm is 
equal to TQ(m) defined in Eq. (j2H) . Furthermore, when we think about the efficiency of 
classical algorithms for finding s such that g{x\/ s) = g{x), we can have discussion similar 
to that held in Sees. El and |31 
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7 Discussion 



In this paper, we discuss the problem that is to find s with querying an oracle, where 
the oracle represents a function that has the invariance, f{x A s) = f{x). The quantum 
algorithm proposed in this paper is more efficient than any classical algorithm for wt(s) = 
1 and wt(s) = n — 1. {n denotes the number of bits in an input of /.) 

Our quantum algorithm requires 0(1) queries on average for wt(s) = 1, while any 
classical algorithm needs at least of the order of \ogn queries. Likewise, our algorithm 
requires O(logn) queries on average for wt(s) = n — 1, while any classical algorithm 
needs at least of the order of n queries. (In both cases, our quantum algorithm is faster 
than any classical algorithm.) However, in general, researchers' motivation for studying 
the quantum computation is to solve a certain problem in quantum polynomial time in 
n rather than classical exponential time in n. (We cannot find an exponential gap in 
n between our quantum algorithm and the best classical algorithm.) From this point 
of view, our quantum algorithm seems not to have a remarkable complexity theoretic 
advantage. However, our algorithm makes good use of properties of quantum mechanics, 
that is, the principle of superposition and its interference, and entanglement. Thus, we 
can say that our algorithm is one of genuine quantum algorithms. Moreover, as mentioned 
in Sec. 01 our quantum algorithm neglects the local properties of the oracle and extracts 
only the global property of the oracle efficiently. 

B.M. Terhal and J. A. Smolin have proposed a quantum algorithm for solving the 
binary search problem with a single query [Hj. By contrast, the classical lower bound of 
queries for this problem is equal to logg n, where n denotes the number of bits in an input 
of an oracle. From a viewpoint of the complexity, our algorithm resembles B.M. Terhal 
and J. A. Smolin's algorithm. 

Simon's algorithm finds s in polynomial time by querying the oracle / that has the 
invariance f{x) = f{x © s). By contrast, any classical computer takes exponential time 
to find s. However, the running time of Simon's algorithm is evaluated in the expected 
sense. Hence, there exists a remote but finite possibility that Simon's algorithm needs 
exponential time for finding s. 

G. Brassard, P. H0yer, T. Mihara, and S.C. Sung have discussed quantum algorithms 
that are guaranteed to solve Simon's problem in polynomial time in the worst case jTU] • As 
mentioned in Sec. El our quantum algorithm is an application of Simon's algorithm, and 
we evaluate its running time (that is, the number of queries) in the expected sense. Thus, 
it may be interesting to study a quantum algorithm that solves the problem discussed in 
this paper more efficiently in the worst case than any classical algorithm. 
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